The certificate based authentication is EAP-TLS. So I suggest you look into that.
You then need a radius server to compare the certificatei and authenticate it. You can use ACS or any other radius server you like.
And yes, the access points, when acting as client (workgroup bridge for example) can authenticate themselves.
Nicolas